
netplus.ch SA
Bounty Range
$93 - $7,440
external program
netplus.ch SA is a service company specialising in the field of telecommunications. The 100% French-speaking area multimedia operator provides more than 220,000 users with high-quality local Internet, telephony, and television services both in towns and rural areas. The company incorporates eleven networks marketing more than 460,000 multimedia services intended for both private and professional customers under the BLI BLA BLO and net+ brand names.
The bug bounty program netplus.ch SA is part of the higher-level bug bounty program of SUISSEDIGITAL association. SUISSEDIGITAL is the trade association of Swiss communication networks. Bringing together some 200 commercial and public sector companies from all over Switzerland and the Principality of Liechtenstein, the association's high-performance networks allow each of its members to act as a one-stop shop offering their customers leading-edge communication services. These services include broadband internet, landline and to some extent mobile telephony as well as radio and television, with all the advantages of digital technology.
The association members of SUISSEDIGITAL operate various services (platforms, services). But only services from explicitly listed domains / URLs are in the scope of the Bug Bounty Program. All other domains or explicitly listed services are therefore not eligible for reward and do not fall under the Legal Safe Harbor Agreement.
Found bugs are eligible for reward only once, even if they are found at several association members (e.g. if the same software is in use). For this purpose, the association members report any vulnerabilities potentially relevant to more members to the association for distribution.
By participating in this Bug Bounty Program, Friendly Hackers undertake to document information about any vulnerability found exclusively via the platform's designated reporting form and not in any other places. They also agree to keep the found vulnerability secret for 90 days after reporting it on the platform. Finally, they undertake to upload to the platform any data from customers that they have obtained as part of a bug bounty program and to delete any local copies afterwards and not to distribute them further.
Friendly Hackers commits to not using methods that have a negative impact on the tested services or their users. Among others these are:
In addition to the prohibited hacking methods listed above, Friendly Hackers are required to immediately discontinue vulnerability scanning if they determine that their conduct will result in a significant degradation (negative impact on regular users or on the operations team) of the Platform's or Service's operations.
Any design or implementation problem can be reported that is reproducible and affects security.
Typical examples:
Other examples:
The following vulnerabilities and forms of documentation are generally not wanted and will be rejected:
In scope:
Out of scope:
All other domains and subdomains (as e.g. webmail). The parental control mechanism is out of scope, as not designed to be hacker proof.
Following endpoints are out of scope:
The organisation gives their approval for Friendly Hackers to use hacking methods based on the specified bug bounty program. Due to this consent, the criminal liability criterion of unauthorized obtaining/unauthorized use and thus the criminal liability of the Friendly Hackers with regard to the criminal offenses in Art. 143 Swiss Criminal Code (Unauthorised obtaining of data) and Art. 143bis Swiss Criminal Code (Unauthorised access to a data processing system) does not apply.
| Severity | Bounty |
|---|---|
| Critical | CHF 5000-6000 |
| High | CHF 2000-4000 |
| Medium | CHF 300-1500 |
| Low | CHF 75-300 |